(On XP, in the event log, this problem will show as "Installation Failure: Windows failed to install the following update with error 0x8007f0f4: Security Update for Windows XP (KB2686509)." in the event log).

Please don't add tags for a specific update, these are usually much too localized.
–
slhck♦May 21 '12 at 22:22

@slhck - Since the question is about that exact update that the way in which it fails (a failure which is VERY specific to the update in question), I'd say it should be tagged with the update.
–
Michael KohneJun 25 '12 at 13:50

Given that there's only one question about KB2686509, it's much too localized. We don't have tags about other specific updates either — there's no gained value from it (no improved search, and there are no tag followers who are experts on "KB2686509"). The tag would have probably been automatically removed anyway. It's great that you posted this question and answer, a great resource, but it doesn't warrant its own tag. By the way, you should be able to even accept your answer below.
–
slhck♦Jun 25 '12 at 13:57

showed no file reference entries with files outside of System32. However, it did show that I had a "Scancode Map" installed in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout.

By removing the Scancode Map key from HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout and then rebooting, I was able to install KB2686509 without further trouble, and I could reinstall my Scancode Map later.

I have a .reg file that disables the Caps lock key. I also have one that restores it back to the default. I saw a reference to re-mapped keys on another site so I tried resetting my caps lock hack back to the default and the Microsoft Security update KB2685609 installed successfully.

Just in case anyone else might benefit from this: after running this "fix-it" (216893), this patch (KB2686509) was able to be successfully applied on my x86 windows sp3 pc.

The advantage of trying this first is that you don't have to muck around in the registry or run some script. I believe I ran the "fix-it" to "enable windows key" (even though I don't think it was ever disabled), rebooted, patch applied, problem resolved (until next time...)